Use Case: Account Manipulation

July 25, 2023 · View on GitHub

Use Case: Account Manipulation

Vendor: Accellion

Product	Event Types	MITRE TTP	Content
Accellion	account-password-change account-password-reset app-activity app-login dlp-email-alert-out failed-app-login file-delete file-download file-read file-upload	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Adaxes

Product	Event Types	MITRE TTP	Content
Adaxes	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Amazon

Product	Event Types	MITRE TTP	Content
AWS CloudTrail	app-activity app-activity-failed app-login cloud-admin-activity cloud-admin-activity-failed failed-app-login storage-access storage-activity storage-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
AWS CloudWatch	app-activity file-alert netflow-connection	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Apache Subversion

Product	Event Types	MITRE TTP	Content
Apache Subversion	app-activity app-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Atlassian

Product	Event Types	MITRE TTP	Content
Atlassian BitBucket	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Barracuda

Product	Event Types	MITRE TTP	Content
Barracuda Firewall	account-password-change account-password-change-failed failed-logon failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: BeyondTrust

Product	Event Types	MITRE TTP	Content
BeyondTrust	account-switch app-activity app-login failed-app-login privileged-access	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
BeyondTrust PowerBroker	privileged-access process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
BeyondTrust Privilege Management	local-logon process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
BeyondTrust Privileged Identity	account-switch app-activity app-login privileged-access	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: BlackBerry

Product	Event Types	MITRE TTP	Content
BlackBerry Protect	app-activity app-login dlp-alert file-alert file-delete file-read process-alert security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Box

Product	Event Types	MITRE TTP	Content
Box Cloud Content Management	app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: CatoNetworks

Product	Event Types	MITRE TTP	Content
Cato Cloud	network-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Centrify

Product	Event Types	MITRE TTP	Content
Centrify Infrastructure Services	process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
Centrify Zero Trust Privilege Services	account-switch app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Check Point Software

Product	Event Types	MITRE TTP	Content
Check Point Identity Awareness	failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Check Point NGFW	app-login dlp-email-alert-in dlp-email-alert-out failed-vpn-login local-logon network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Check Point Security Gateway	failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Check Point Threat Prevention	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Cisco

Product	Event Types	MITRE TTP	Content
AnyConnect	process-network vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Cisco ACS	app-activity authentication-failed authentication-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Cisco Adaptive Security Appliance	authentication-failed authentication-successful dns-response failed-logon failed-vpn-login file-download file-upload nac-logon network-connection-successful process-created remote-logon vpn-login vpn-logout web-activity-denied	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	20 Rules 9 Models
Cisco Call Manager	app-activity app-activity-failed authentication-failed authentication-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Cisco Firepower	authentication-successful dns-query dns-response nac-logon netflow-connection network-alert network-connection-failed network-connection-successful security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Cisco ISE	app-activity authentication-failed authentication-successful computer-logon failed-vpn-login nac-failed-logon nac-logon remote-logon vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models
Cisco Meraki MX appliances	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Cisco NPE	process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
Cisco TACACS	process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
Duo Access Security	account-creation app-activity app-login authentication-failed authentication-successful failed-app-login	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136.001 - Create Account: Create: Local Account	9 Rules 6 Models

Vendor: Citrix

Product	Event Types	MITRE TTP	Content
Citrix Endpoint Management	app-activity remote-logon	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Citrix Gateway ActiveSync Connector	app-activity app-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Citrix Netscaler	app-activity app-login authentication-failed failed-vpn-login process-created vpn-login vpn-logout	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	23 Rules 9 Models
Citrix Netscaler VPN	authentication-failed authentication-successful remote-access remote-logon vpn-connection vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models
Citrix ShareFile	app-activity app-login failed-app-login file-download file-upload	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Cloudflare

Product	Event Types	MITRE TTP	Content
Cloudflare Insights	app-activity app-login member-added member-removed	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	12 Rules 8 Models

Vendor: CrowdStrike

Product	Event Types	MITRE TTP	Content
Falcon	app-activity app-activity-failed app-login authentication-failed batch-logon computer-logon config-change dlp-alert dns-query failed-app-login file-alert file-delete file-download file-read file-write local-logon network-connection-successful process-alert process-created process-network remote-access remote-logon security-alert service-logon task-created usb-activity usb-insert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models

Vendor: CyberArk

Product	Event Types	MITRE TTP	Content
CyberArk Vault	account-password-change account-password-change-failed account-password-reset account-switch app-activity app-activity-failed app-login failed-app-login failed-logon file-delete file-permission-change file-read file-write remote-logon security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Privileged Session Manager	account-switch app-activity app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Dell

Product	Event Types	MITRE TTP	Content
One Identity Manager	account-password-change account-switch app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
SonicWALL Aventail	vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Digital Guardian

Product	Event Types	MITRE TTP	Content
Digital Guardian Endpoint Protection	app-activity dlp-alert dlp-email-alert-out file-delete file-download file-read file-upload file-write local-logon print-activity process-created usb-insert usb-write	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models

Vendor: Dropbox

Product	Event Types	MITRE TTP	Content
Dropbox	app-activity app-login file-delete file-download file-permission-change file-read file-write vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models

Vendor: Dtex Systems

Product	Event Types	MITRE TTP	Content
DTEX InTERCEPT	file-write local-logon print-activity process-created remote-logon usb-write web-activity-allowed workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: Duo Access Security

Product	Event Types	MITRE TTP	Content
Duo Access Security	app-activity failed-vpn-login vpn-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: EMP

Product	Event Types	MITRE TTP	Content
EMP	app-activity app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Epic

Product	Event Types	MITRE TTP	Content
Epic SIEM	account-password-change account-password-change-failed app-activity app-login authentication-successful failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: F5

Product	Event Types	MITRE TTP	Content
F5 BIG-IP Access Policy Manager (APM)	authentication-failed authentication-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Forcepoint

Product	Event Types	MITRE TTP	Content
Forcepoint CASB	app-activity app-login failed-app-login security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Fortinet

Product	Event Types	MITRE TTP	Content
Fortinet Enterprise Firewall	app-activity app-activity-failed computer-logon netflow-connection network-connection-failed network-connection-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Fortinet UTM	app-activity app-activity-failed authentication-failed authentication-successful dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-vpn-login network-alert security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models
Fortinet VPN	authentication-successful vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: GitHub

Product	Event Types	MITRE TTP	Content
GitHub	app-activity app-activity-failed app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Google

Product	Event Types	MITRE TTP	Content
Google Calendar	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Google Cloud Platform	app-activity cloud-admin-activity cloud-admin-activity-failed storage-access storage-activity storage-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: HP

Product	Event Types	MITRE TTP	Content
HP Comware	process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: HelpSystems

Product	Event Types	MITRE TTP	Content
Powertech Identity Access Manager (BoKs)	account-switch file-delete file-read file-write local-logon process-created remote-logon	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: Huawei

Product	Event Types	MITRE TTP	Content
Unified Security Gateway	authentication-successful network-alert process-created vpn-login	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: IBM

Product	Event Types	MITRE TTP	Content
IBM Racf	app-activity app-login database-access database-failed-login database-update failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
IBM Sterling B2B Integrator	app-activity failed-logon member-added member-removed remote-logon	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	12 Rules 8 Models

Vendor: ICDB

Product	Event Types	MITRE TTP	Content
ICDB	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Infoblox

Product	Event Types	MITRE TTP	Content
Infoblox BloxOne	app-activity app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Ipswitch

Product	Event Types	MITRE TTP	Content
IPswitch MoveIt	app-activity app-login failed-app-login file-read file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
MoveIt DMZ	account-password-change authentication-failed authentication-successful failed-logon file-delete file-download file-upload file-write member-added	T1098 - Account Manipulation	9 Rules 7 Models

Vendor: Juniper Networks

Product	Event Types	MITRE TTP	Content
Juniper Networks Pulse Secure	account-deleted app-activity vpn-login	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
Juniper SRX	account-deleted authentication-failed authentication-successful failed-vpn-login network-alert network-connection-failed network-connection-successful security-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	5 Rules 4 Models
Juniper VPN	account-deleted authentication-failed authentication-successful failed-vpn-login vpn-login vpn-logout web-activity-allowed	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	5 Rules 4 Models

Vendor: Kemp

Product	Event Types	MITRE TTP	Content
Kemp LoadMaster	app-activity remote-logon security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Kiteworks

Product	Event Types	MITRE TTP	Content
Kiteworks	account-password-change app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LEAP

Product	Event Types	MITRE TTP	Content
LEAP	app-activity app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LOGBinder

Product	Event Types	MITRE TTP	Content
SharePoint	app-activity file-read file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LanScope Cat

Product	Event Types	MITRE TTP	Content
LanScope Cat	app-activity file-delete file-write process-created process-created-failed process-network	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models

Vendor: LanScope

Product	Event Types	MITRE TTP	Content
LanScope Cat	app-activity dlp-alert failed-usb-activity local-logon print-activity usb-activity usb-write web-activity-allowed workstation-locked workstation-unlocked	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LastPass

Product	Event Types	MITRE TTP	Content
LastPass	app-activity app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LogRhythm

Product	Event Types	MITRE TTP	Content
LogRhythm	process-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: McAfee

Product	Event Types	MITRE TTP	Content
Skyhigh Networks CASB	app-activity app-login dlp-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Microsoft

Product	Event Types	MITRE TTP	Content
Exchange	app-activity app-activity-failed dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft Azure	app-activity app-activity-failed app-login authentication-failed authentication-successful cloud-admin-activity cloud-admin-activity-failed failed-app-login file-delete file-download file-read file-upload file-write network-alert network-connection-failed network-connection-successful process-created storage-access storage-activity storage-activity-failed	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models
Microsoft Azure Active Directory	account-password-change app-activity app-activity-failed app-login authentication-failed failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft Azure MFA	app-activity authentication-failed authentication-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft Cloud App Security (MCAS)	app-activity app-login failed-app-login file-delete file-upload file-write member-added member-removed process-created process-network process-network-failed security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	28 Rules 13 Models
Microsoft Defender ATP	process-created security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
Microsoft Office 365	account-disabled account-password-change account-unlocked app-activity app-activity-failed app-login database-query dlp-alert dlp-email-alert-in dlp-email-alert-out dns-query failed-app-login file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed network-connection-failed network-connection-successful process-created remote-logon security-alert usb-activity usb-insert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	28 Rules 13 Models
Microsoft OneDrive	app-activity file-read	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft Sysmon	dns-query file-delete file-write image-loaded process-created process-network	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
Microsoft Windows	account-creation account-deleted account-disabled account-enabled account-lockout account-password-change account-password-change-failed account-password-reset account-switch account-unlocked app-login audit-log-clear audit-policy-change authentication-failed authentication-successful batch-logon computer-logon config-change database-login dcom-activation-failed dns-query dns-response ds-access failed-app-login failed-logon failed-vpn-login file-close file-delete file-read file-write kerberos-logon local-logon logout-remote member-added member-removed nac-failed-logon nac-logon network-connection-successful ntlm-logon privileged-access privileged-object-access process-created process-network process-network-failed remote-access remote-logon security-alert service-created service-logon share-access share-access-denied task-created usb-activity usb-insert vpn-login vpn-logout winsession-disconnect workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1207 - Rogue Domain Controller T1531 - Account Access Removal	43 Rules 26 Models
Windows Defender	app-activity app-activity-failed app-login dlp-alert failed-app-login security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Mimecast

Product	Event Types	MITRE TTP	Content
Mimecast	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Mimecast Email Security	app-activity app-login dlp-email-alert-in dlp-email-alert-in-failed failed-app-login file-delete file-read file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: NCP

Product	Event Types	MITRE TTP	Content
NCP	authentication-failed vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Namespace rDirectory

Product	Event Types	MITRE TTP	Content
Namespace rDirectory	account-creation account-deleted account-disabled account-enabled account-password-change ds-access member-added	T1098 - Account Manipulation T1136.001 - Create Account: Create: Local Account T1207 - Rogue Domain Controller	23 Rules 17 Models

Vendor: NetDocs

Product	Event Types	MITRE TTP	Content
NetDocs	app-activity file-delete file-read file-upload file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: NetMotion Wireless

Product	Event Types	MITRE TTP	Content
NetMotion Wireless	vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Netskope

Product	Event Types	MITRE TTP	Content
Netskope Security Cloud	app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write network-connection-failed network-connection-successful security-alert web-activity-allowed web-activity-denied	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Netwrix

Product	Event Types	MITRE TTP	Content
Netwrix Auditor	account-disabled account-lockout account-password-reset account-unlocked app-activity app-login database-access database-failed-login ds-access failed-app-login failed-logon file-delete file-write member-added member-removed	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1207 - Rogue Domain Controller	21 Rules 15 Models

Vendor: Nortel Contivity

Product	Event Types	MITRE TTP	Content
Nortel Contivity VPN	vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: ObserveIT

Product	Event Types	MITRE TTP	Content
ObserveIT	app-activity app-login database-access dlp-alert failed-app-login process-created remote-logon security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models

Vendor: Okta

Product	Event Types	MITRE TTP	Content
Okta Adaptive MFA	account-lockout account-password-reset account-unlocked app-activity app-activity-failed app-login authentication-failed authentication-successful failed-app-login member-added security-alert	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	12 Rules 8 Models

Vendor: OneLogin

Product	Event Types	MITRE TTP	Content
OneLogin	account-password-reset app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Oracle

Product	Event Types	MITRE TTP	Content
Oracle Access Manager	app-activity app-login authentication-failed authentication-successful failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Oracle Solaris	process-created process-created-failed	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: Palo Alto Networks

Product	Event Types	MITRE TTP	Content
Cortex XDR	app-activity app-login security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
GlobalProtect	app-activity authentication-failed authentication-successful config-change failed-logon failed-vpn-login network-connection-failed network-connection-successful remote-logon vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models
NGFW	app-activity config-change dlp-alert failed-vpn-login file-alert network-alert network-connection-failed network-connection-successful remote-logon security-alert vpn-login web-activity-allowed web-activity-denied	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Palo Alto Aperture	app-activity app-login dlp-alert file-delete file-download file-read file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Paxton

Product	Event Types	MITRE TTP	Content
NET2DOOR	account-password-change account-password-change-failed app-activity app-activity-failed app-login authentication-failed authentication-successful failed-app-login failed-physical-access file-delete file-download file-read file-upload file-write physical-access	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Perforce

Product	Event Types	MITRE TTP	Content
Perforce	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: PowerSentry

Product	Event Types	MITRE TTP	Content
PowerSentry	app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Procad

Product	Event Types	MITRE TTP	Content
Pro.File DMS	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Quest InTrust

Product	Event Types	MITRE TTP	Content
Quest InTrust	computer-logon process-created usb-activity	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: Quest Software

Product	Event Types	MITRE TTP	Content
Change Auditor	ds-access failed-ds-access failed-logon	T1098 - Account Manipulation T1207 - Rogue Domain Controller	11 Rules 7 Models

Vendor: RSA

Product	Event Types	MITRE TTP	Content
SecurID	authentication-failed authentication-successful vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: RangerAudit

Product	Event Types	MITRE TTP	Content
RangerAudit	app-activity app-login database-activity-failed database-query failed-app-login file-read file-write	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: SAP

Product	Event Types	MITRE TTP	Content
SAP	account-creation account-deleted account-lockout account-unlocked app-activity authentication-failed authentication-successful file-download remote-logon	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models

Vendor: SSL Open VPN

Product	Event Types	MITRE TTP	Content
SSL Open VPN	app-activity app-activity-failed authentication-failed failed-vpn-login vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models

Vendor: Sailpoint

Product	Event Types	MITRE TTP	Content
IdentityNow	app-activity app-login authentication-failed authentication-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
SecurityIQ	account-creation account-deleted account-lockout account-password-reset file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed	T1098 - Account Manipulation T1136.001 - Create Account: Create: Local Account	14 Rules 10 Models

Vendor: Salesforce

Product	Event Types	MITRE TTP	Content
Salesforce	app-activity app-login failed-app-login file-download file-upload	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: SecureLink

Product	Event Types	MITRE TTP	Content
SecureLink	app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: SecureNet

Product	Event Types	MITRE TTP	Content
SecureNet	vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: SentinelOne

Product	Event Types	MITRE TTP	Content
SentinelOne	app-activity dns-query dns-response file-alert file-delete file-read file-write network-alert network-connection-failed network-connection-successful process-created security-alert task-created web-activity-allowed	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models

Vendor: ServiceNow

Product	Event Types	MITRE TTP	Content
ServiceNow	account-switch app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-download file-read file-upload file-write remote-logon	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: SkySea

Product	Event Types	MITRE TTP	Content
ClientView	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity security-alert share-access web-activity-allowed web-activity-denied	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Slack

Product	Event Types	MITRE TTP	Content
BeyondTrust Secure Remote Access	app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Epic SIEM	app-activity failed-physical-access file-delete file-write physical-access	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Exabeam Advanced Analytics	account-disabled account-enabled account-password-change account-unlocked app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-permission-change file-read file-write nac-logon security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Slack	account-password-change app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-download file-read file-upload file-write remote-logon	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Sonicwall

Product	Event Types	MITRE TTP	Content
Sonicwall	authentication-failed authentication-successful failed-vpn-login remote-logon vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Sophos

Product	Event Types	MITRE TTP	Content
Sophos SafeGuard	app-activity app-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Sophos XG Firewall	dlp-alert failed-vpn-login network-connection-failed network-connection-successful security-alert vpn-login vpn-logout web-activity-denied	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: StealthBits

Product	Event Types	MITRE TTP	Content
StealthIntercept	account-disabled account-enabled ds-access failed-ds-access file-permission-change file-read file-write member-added member-removed	T1098 - Account Manipulation T1207 - Rogue Domain Controller	20 Rules 14 Models

Vendor: Swipes

Product	Event Types	MITRE TTP	Content
Sonicwall	failed-vpn-login remote-logon vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Swivel

Product	Event Types	MITRE TTP	Content
Swivel	app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Symantec

Product	Event Types	MITRE TTP	Content
Symantec CloudSOC	app-activity app-login dlp-alert failed-app-login file-delete file-download file-upload	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Symantec DLP	config-change dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon failed-usb-activity member-added member-removed network-alert process-alert security-alert usb-activity usb-insert usb-read usb-write	T1098 - Account Manipulation	9 Rules 7 Models
Symantec Endpoint Protection	app-activity network-alert network-connection-failed network-connection-successful process-alert security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Symantec VIP	app-activity app-activity-failed authentication-failed authentication-successful	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Tanium

Product	Event Types	MITRE TTP	Content
Endpoint Platform	authentication-failed authentication-successful dns-response process-created security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models

Vendor: Thycotic Secret Server

Product	Event Types	MITRE TTP	Content
Thycotic Secret Server	account-switch app-activity app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Tyco

Product	Event Types	MITRE TTP	Content
CCURE Building Management System	app-activity app-login failed-physical-access physical-access	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Unix

Product	Event Types	MITRE TTP	Content
Auditbeat	app-activity app-activity-failed authentication-successful process-created process-network process-network-failed	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	19 Rules 6 Models
FTP	app-activity app-activity-failed	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Unix	account-creation account-deleted account-lockout account-password-change account-switch authentication-failed authentication-successful batch-logon computer-logon dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon file-delete file-read file-write kerberos-logon local-logon member-added member-removed process-created process-created-failed remote-access remote-logon security-alert task-created	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	30 Rules 15 Models
Unix Auditd	account-deleted account-password-change account-switch app-activity-failed authentication-failed authentication-successful failed-logon file-read file-write local-logon member-added member-removed process-created process-created-failed remote-logon security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	26 Rules 12 Models

Vendor: VMware

Product	Event Types	MITRE TTP	Content
VMware Carbon Black App Control	app-login file-alert file-delete file-download file-read file-write local-logon network-connection-failed network-connection-successful process-alert process-created process-created-failed process-network security-alert usb-insert workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
VMware Carbon Black Cloud Endpoint Standard	file-read file-write network-alert network-connection-successful process-created security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
VMware Carbon Black EDR	process-alert process-created security-alert	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	16 Rules 5 Models
VMware VCenter	app-activity app-login failed-logon remote-logon	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
VMware View	account-password-change app-activity app-login failed-app-login remote-logon	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Varonis

Product	Event Types	MITRE TTP	Content
Data Security Platform	authentication-failed authentication-successful dlp-alert file-delete file-permission-change file-read file-write vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: Vectra

Product	Event Types	MITRE TTP	Content
Vectra Cognito Detect	app-activity security-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Workday

Product	Event Types	MITRE TTP	Content
Workday	app-activity app-login authentication-failed failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zeek

Product	Event Types	MITRE TTP	Content
Zeek Network Security Monitor	app-activity authentication-failed authentication-successful computer-logon dlp-email-alert-in dlp-email-alert-out dns-query dns-response failed-logon file-delete file-read file-write kerberos-logon nac-failed-logon nac-logon network-alert network-connection-failed network-connection-successful ntlm-logon remote-access remote-logon share-access web-activity-allowed web-activity-denied	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zlock

Product	Event Types	MITRE TTP	Content
Zlock	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zscaler

Product	Event Types	MITRE TTP	Content
Zscaler Private Access	vpn-login vpn-logout	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 4 Models

Vendor: eDocs

Product	Event Types	MITRE TTP	Content
eDocs	app-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: iManage

Product	Event Types	MITRE TTP	Content
iManage	app-activity dlp-alert	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: oVirt

Product	Event Types	MITRE TTP	Content
oVirt	app-activity app-activity-failed app-login failed-app-login	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models